A non-distillability criterion for secret correlations 
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Within entanglement theory there are criteria which certify that some quantum states cannot be 
distilled into pure entanglement. An example is the positive partial transposition criterion. Here 
we present, for the first time, the analogous thing for secret correlations. We introduce a com- 
putable criterion which certifies that a probability distribution between two honest parties and an 
eavesdropper cannot be (asymptotically) distilled into a secret key. The existence of non-distillable 
correlations with positive secrecy cost, also known as bound information, is an open question. This 
criterion may be the key for finding bound information. However, if it turns out that this criterion 
does not detect bound information, then, a very interesting consequence follows: any distribution 
with positive secrecy cost can increase the secrecy content of another distribution. In other words, 
all correlations with positive secrecy cost constitute a useful resource. 



I. INTRODUCTION 

Information theoretic cryptology started with Shan- 
non [201, and it established that secret communication 
relied entirely on secret key; but not until Wyner's fa- 
mous wiretap paper [23| was it recognized that noise in 
the eavesdropper's channel can be used to establish se- 
crecy in a communication. The secrecy capacity of what 
is now called the general wiretap channel was determined 
in Q. After that, again, it took some while before the 
distillation of key from given correlation Pabe between 
two cooperating players, Alice (A) and Bob (B), and an 
eavesdropper Eve (E) was considered [3, llalj in a model 
where the three parties share a large number of copies 
of the given distribution Pabe, and Alice and Bob can 
freely exchange messages over an authenticated but pub- 
lic channel (i.e., monitored by Eve). 

Indeed, Maurer [ly| showed that this scenario is much 
richer than the one of the wiretap channel. His paper 
posed the problem of determining the optimal secret key 
rate of any given distribution Pabe, in the discrete mem- 
oryless setting of availability of asymptotically many in- 
dependent samples of the distribution, and in particular 
the problem of deciding whether a distribution can be 
distilled into a secret key or not. 

There has by now been a long history of fruitful ex- 
change of ideas between cryptography and entanglement 
theory (see e.g. [3|), mostly relating protocols for secret 
key and entanglement distillation. In the quantum case, 
the reverse process was considerred in [3] : create a quan- 
tum state from pure entanglement with maximum effi- 
ciency. Subsequently it was shown that there exist states 
that require a positive rate of entanglement to be cre- 
ated, but yield no pure entanglement at all under any 
distillation procedure. These states are called bound en- 
tanglement [9|, |2l|. The key to show the existence of 
bound entanglement is the positive partial transposition 
criterion [l^, which certifies that a given state is not 
distillable. 



This motivated Gisin and Wolf |8| to speculate on the 
existence of bound information, i.e. distributions that 
yield no secret key under distillation but nevertheless 
somehow contain secrecy. They presented some candi- 
dates for bound information derived from bound entan- 
gled quantum states. Subsequently, the notion of secret 
key cost of a given distribution Pabe was formalised (un- 
der the name information of formation) [l9|. Roughly 
speaking, this is the minimum amount of secret bits that 
are necessary in order to generate Pabe from public 
communication. Latter, a single-letter formula for this 
quantity was found |22l | . 

Renner and Wolf [l0| have shown that there can be ar- 
bitrarily large gaps between the secret key cost and the 
key distillation rate, thus providing evidence for the ex- 
istence of bound information (see also [^^ ) . In [l|, llj| it 
was shown that multipartite (i.e., more than two honest 
players) bound information indeed exists. But nothing 
is known about the existence of bound information in 
the bipartite case. The reason is that no criterion for 
non-distillability of secret correlations is known. In this 
paper we present the first one, which is based on the idea 
presented in [Ij, [l^ . 



II. NOTATION 

Key distillation and key cost are most conveniently ex- 
pressed via the probability distribution from which Alice, 
Bob and Eve observe samples. A generic multipartite 
probability distribution among the parties AB. . . is de- 
noted by a non- negative vector Pab... belonging to the 
K-linear space J^a ^ ■^b ® ■ ■ ■ which comes with a dis- 
tinguished (tensor product) basis. This distinguished, 
"computational", basis of the local space M'a bas one 
element for each outcome from the alphabet of A. For 
instance, the computational basis of a bit SS consists of 
the two vectors (1,0) and (0,1). Note that for generic 
alphabets we use M' to denote the vector space, but for 
bits (two dimensions) we reserve SS. Furthermore, to 



identify which party has access to the sample from a fac- 
tor in the tensor product, we attach generic indices A, B 
and E; if the space of one party consists of several alpha- 
bets, we denote them A, A' , A" , etc. The coefficients of 
Pab... in the computational (product) basis are denoted 
by PAB..io-ib, ■ ■ .), and each corresponds to the proba- 
bility of the event with outcomes (a, 6...). Hence all 
the coefficients of Pab... must be non-negative. Unless 
explicitly mentioned, we allow probability distributions 
Pab... to be not normalized. 

A general (stochastic) operation A1 , which may be fil- 
tering (i.e., not preserving probability), is represented by 
a linear map with non-negative coefficients M : J^i — *■ 
J^ . Because we do not care about normalization, there 
is no additional constraint on the coefficients of A^, apart 
from non-negativity. In the case of local operations, we 
specify which party performs each operation by attach- 
ing an appropriate index, e.g. Ma-N'b- We omit the 
tensor product sign, and the identity matrix for the re- 
maining parties. 



III. PRELIMINARY RESULTS 

The secret bit fraction was introduced in [l3|, as the 
secrecy analog of the quantum singlet fraction, intro- 
duced in 11]. 

Definition 1 (secret bit fraction). Suppose Pabe 
is a tripartite normalized probability distribution, where 
the outcomes corresponding to parties A and B take val- 
ues on {0, 1}. The secret bit fraction of Pabe, denoted 
\[Pabe\, is the maximum value of /i for which a decom- 
position 



Pas£=M^abPb + (1-m)PJ( 



ABE 



fl) 



exists, where P'^ and P^be ^^^ arbitrary normalized dis- 
tributions, and 5 is a secret bit shared by two parties: 
S{a,b) = ^SaM- 

Lemma 2. The secret bit fraction of Pabe can be 
written as 



X[Pabe] = 2 



J2^ mm{PABE{0, 0, e),PABEil, 1, e)} 

T,a,b,ePABE{a,b,e) 



(2) 

This is proven in [iJl. We have included the normal- 
ization factor in the denominator of ^ in order not to 
worry about the normalization of Pabe, in this way, 
the quantity X[Pabe] makes sense irrespective of nor- 
malization of Pabe- Note that A[PyiBB] = 1 means that 
Pabe = SabP'e, so that Pabe represents a secret bit 
between Alice and Bob. 

Definition 3. The maximal extractable secret bit 
fraction of a given distribution Pabe G J^ ® J^b ® -^e 
is 



A[Pas_e] = sup 

MaMi 



\[MaMbPabe] 



(3) 



where the optimization is made over maps 
Ma ■■ M'a ^ S§ and Mb ■■ J^B ^ ^■ 

Note that the function \\Pabe\ is only defined for dis- 
tributions Pabe where the alphabets of A, B are {0, 1}, 
hence, in the definition of A, it is important that the 
range of the maps M.AtM.b is 3§. On the other hand, 
the function A is defined on probability distributions 
Pabe for random variables taking values on arbitrary 
alphabets. The maximal extractable secret bit fraction 
expresses the quality of the secret bit that can be ex- 
tracted from a single copy of a given distribution. If 
A[Pas_e] = 1 then a perfect secret bit can be extracted 
from a single copy of Pabe- If Pabe is the product 
of two uniformly random bits (one for each of the hon- 
est parties) and any uncorrelated information for Eve, 
then A[Pabb] = 1/2. Because the output of the maps 
M.AtM.b can always be an independent uniform random 
bit, irrespecti vely of the input, the range of A is [1/2, 1]. 
It is shown in [I4I that the quantity A is a secrecy mono- 
tone, and hence, constitutes a measure of the amount of 
secrecy contained in a given Pabe- Additionally, there 
is a relation between this single-copy secrecy measure 
and asymptotic distillability. It is shown in [I4I that if 
A[Pab_e] > 1/2 then Pabe is distillable. In what follows 
we rephrase the definition of distillability in terms of A. 

Definition 4 (Distillability). We say that 
the distribution Pabe G '^a ® -^^b ® =^^ is 
(secret-key-)distillable if for each Aq G [1/2, 1) there ex- 
ists an integer n such that A[P®^'^] > Aq. 

That is, from a sufficiently large number of copies of 
Pabe, Alice and Bob can, by local operations and pub- 
lic communication (which, without loss of generality, can 
be assumed to be a filtering of the form written in ([3])), 
obtain arbitrarily good approximations to a secret bit. 
If there exists n such that MPabe\ > -i/^j one can ap- 
ply advantage distillation [l6[ to the result and obtain 
a secret key (see [IJI)- Note furthermore that in this 
case even positive rates of secret key can be obtained, as 
n — > 00. (The reader familiar with entanglement theory 
will realize the similarity of these concepts to singlet frac- 
tion and singlet distillability.) The difficulty in dealing 
with distillability is that its definition involves an arbi- 
trarily large number of copies of Pabe- The following 
tools deal with this problem. 

Lemma 5. Let ^, M2 and c^ be given vector 
spaces. Any "global" linear map M. : J^i ® J^2 — > 
■j^z with non-negative coefficients can be decomposed 
into a local linear map with non-negative coefficients, 
M' ■- ^i ^ Mi. ® ^1(2 (which depends on A^), and a 
simple global linear map with non-negative coefficients, 
U : (J^ ® ■J^2) ® '^2 -^ '^3 (which is independent of 
M, that is, universal, and given by U^^^^y^ = 5^.1, 5x2y2), 
such that M = UM'. 

Proof. If we adopt the convention that lower indices cor- 
respond to the input and upper indices to the output, we 



can write M' in terms of M as M'^,^"^^ = A^??^.- The 



equality 



^^y.- E ^k.4(-^^ 



/a:3a;2 



2:22:31(2 



holds by definition. 



D 



Lemma 6. If the distribution Pabe S 

,^A ® '^B ® 'J^E is distillable, then for each Ao S [1/2, 1) 
there exists a distribution Qabe' G (^a "Xi^^) ® (^s ^ 
J^B ) ® -^^' such that 



MQabe'] < Ao 
\[UaUb Qabe' ® ^abb] > Ao 



(5) 
(6) 



where U is defined in Lemma 5. The size of J^e' is 
arbitrary. 

Proof. Let n be the smallest integer such that there exist 



operations Ma 



.^f'' 



SSa and Mb : ^r 



such that \\MaMb PTbe^ > ^0 (following Definition 4). 
According to Lemma 5 there are maps A4'j^,Afg such 
that A4a ~ i^AMl'j^, Mb = UbM'e, and the distribution 

Qabe' = M'aM'bPTbe^^ has alphabet {S§a ® -^a) ® 
{S§B ® ■^b) ^ '^E', as we want to show. Because A is 
defined through an optimization (Definition 3), we have 



HP. 



ABE 



>MM\MUP' 



5(n-l)i 



B ^ABE 



m 



ABE' 



(7) 



j8(n- 



The definition of n implies that M^P'^b^e \ — ^0, which 
together with ([7]), implies ([5]). Using the properties of 
the maps IA,M[',M' shown in Lemma 5, one can check 
that 



UaUb Qabe- ® Pabe = MaMb Pfs 



ABE ■ 



(8) 



Recall that the maps M.AtMb are the ones for which 
\{MAMBPABE^ > ^0, which together with ^, impUes 
®. □ 

In other words, what Lemma 6 tells is that if a distri- 
bution Pabe is distillable, then it can activate the se- 
crecy of another distribution Qabe- Here by activation 
we mean enhancement of the maximal extractable secret 
bit fraction A[-]. The important point is that Alice's and 
Bob's alphabets in Qabe are bounded. Unfortunately, 
Lemma 6 does not tell anything about the size of Eve's 
alphabet in Qabe' , that is .y^fE' , but this problem will 
later sort out itself. 



IV. NON-DISTILLABILITY CRITERION 

In order to certify that a given distribution Gabe G 
,J^A ® ■^B ® ■^E is undistillable, it suffices to obtain 
a contradiction between the inequalities ([5]) and ^. 
However, the characterization of the set of distributions 
Qabe' G {SSa ® ^A) ® {^B ® ■^b) ® -^E', where the 



size of J^' is arbitrary, satisfying A[A^aA/bQabb'] < Ao 
for any pair of maps M.AtMb is not available. Instead, 
we consider a larger (but simpler) set. For any given 



(4) finite family of pairs of maps T = {{M.\,Me) 



1, . . . M}, we consider the set of distributions which sat- 
isfy \[M\MeQabe'] < Ao for i = 1,...M. In what 
follows we particularize to Aq — 1/2, although different 
criteria could be obtained for different values of Aq. An- 
other big simplification is to write the inequalities ([5]) 
and (O as "almost" -linear in the vector Qabe'- If we 
denote by e the variable of J^e , and by e' the variable 
of J^E' , we can write ([SJ and (O as 

2y^ min {[UaI^b Qabe' ^ GABE]ia,a,e' ,e)\ 
^-^ ae{o,i}l } 

e' ,e 

- 2 E [^^^s Qabe' ® GABEKa, 6, e', e) > (9) 

a,b,e' ,e 

2 V min \[MAMBQABE'Ka,a,e')] 

'^-^ ae{0.1} I J 

e' 

-IY. ^^AM'BQABE']{a,b,e')<0, (10) 



a.b,e' 



for i = f , . . . M. This is obtained by using the explicit 
form of A[-] given in ^, and setting Ao = 1/2. 

Denote by d the dimension of J^e . In ^ and (|10p the 
summation over e runs over d values, while the summa- 
tion over e' is unbounded (like the dimension of J^e')- 
In what follows we transform the summation over e' into 
one over 2*^+*^ values. For each e = 1, . . .d, define the 
function 



re{e') 



if Eai-^TPlAKBQABE' (^GABEKa,a,e',e) <0 

1 if Eai-'^)"PAI^BQABE' <»GABE]{a,a,e',e) > 



for all e' . Analogously, for each i — 1, . . . M define the 
function 



s.(e') 



_/0 if j:ai-'^T[-M\MhQABE'Ka,a,e') <0 
1 if j:ai-'^n^A^hQABE']{a,a,e') > 



for all e'. Using these definitions we can write, for any 
value of e, i, e', 

min I [UaUb Qabe' <8) GABE]{a, a, e',e)\ 
ae{o,i} L J 

= [UAKBQABE'(g)GABEKre{e'),re{e'),e',e) , (11) 
min \[M\M'BQABE']ia,a,e')\ 



[M\M'BQABE']{s^{e'),s,{e'),e') 



(12) 



which allows to get rid of the min-functions in ([9|) and 
pH)) . Let us define the new variable k in the following 
way 

k(e') = (ro(e'), ri(e'), • ■ • rd(e'), si(e'), • ■ • SM(e')), (13) 



which has the natural distribution and correlations with 



QABK{a,b,'ko) = ^ QABE'{a,b,e') . (14) 

e':k(e')=ko 



This allows to write the identities 

V" min I [UaI^b Qabe' » Gabe] (a, a, e',e)\ 

e ,e 

= ^ [UaUbQabk '»GABE]{ke,ke,k,e) , (15) 
k.e 

V min I [MaMb QABE'Ka, a,e')\ 
^ ae{o,i} L J 

e 

= ^ [A^^A4^QABK](A:d+z,fcd+^,k) , (16) 



where we have used the fact that when {a;o < x\ and 
yo < yi} or {xo > xi and yo > yi} the equality 



min{a;o,a::i} + min{j/o,l/i} = minjxo + yo, a;i +yi} (17) 



holds. After grouping the different values of e' as in (fT4|) . 
we only need to consider distributions Qabk where the 
variable k runs over 2''+*^ different values. However, the 
new (bounded in size) distribution Qabk must satisfy 
the constraints 



^{-ITIUaUbQabk ® GabeKK ®a,k^® a,k, e) < 

a 

Y,i-^T[^AMBQABK]{kd+^ © O, k^+i © fl, k) < , 
a 

for all e, «, k. 



Now everything is finite. Qabk is a vector from the 
space {diva Ma x AiviiM'b x 2^*+*^+^) with non-negative 
components, that is QAS_R'(a, ^,k) > for all a, 6, k. 
Hence, the set of allowed distributions Qabk is charac- 
terized by a finite set of linear inequalities. Then, maxi- 
mizing the left-hand side of © is a linear programming 



problem. 

LINEAR PROGRAMMING: (18) 

[If the maximum is zero then Gabe is undistillable.] 

max V" [A^IAaUb Qabk ® GABE]{ke, fee, k, e)- 

Qabk , — ^ 
k,e 

-'^[UaUbQabk <»GABE]{a,b,'k,e)] 
with constrains 

"^YI^M'aM'b QABK]{kd+i,kd+i,k)- 
k 

- J2 [MAMBQABK]{a,b,k) <0 , 
a,fe,k 

^{~1)"-[UaUb Qabk <» GABE]{ke ® a, ke (B a,k,e) < 

a 

^{~l)''[MAMBQABK]{kd+i®a,kd+^(Sa,k) <0 , 

a 

y^ QABK{a,b,k) = 1 

a,6,k 

QABK{a,b,k) > , 

for all i = 1,...M, all k e {0,1}''+^'^ and all a,b e 
{0, 1} in the last inequality. 

If the given distribution Gabe has rational coeffi- 
cients, the above linear programming can be solved by 
exact methods like the simplex algorithm [y| . Or by 
quasi-exact methods like the interior point algorithm [J] , 
whose solution can always be certified exactly. The last 
method is faster, and hence can deal with larger values 
of M. 

A key feature of this method is to choose a suitable 
family J^ of pairs of maps. The larger the size of this 
family (M) the more constrains on the above maximiza- 
tion, and more chances to get the maximum equal to 
zero. 

V. REMARKS 

If the maximum of the linear programming (jlSp is zero 
then we know for sure that Gabe is undistillable. But 
actually, we know something much stronger: Gabe can- 
not activate any other non-distillable distribution. In 
other words, the correlations in Gabe are completely 
useless. 

Lemma 7. Let the distribution Gabe be such that 
the maximum of the linear programming US}) is zero. If 
Pabe is a non-distillable distribution, then the tensor- 
product Pabe ® Gabe is also non-distillable. 

Proof. By assumption, for any distribution Qabe such 
that A[Qabe] < 1/2 we have A[Qabe ® Gabe] < 1/2. 
In particular, if we chose Qabe — Pabe '^'^ have 



HiPfSE 



Gabe] < 1/2, for any n. But this also implies 

_ S) Gabe) '9 Gabe] < 1/2, and proceeding by 

induction, we obtain A[{Pabe ® Gabb)®"] < 1/2. □ 

An interesting possibility is that for any distribution 
Gabe with positive secrecy cost all linear programming 
problems (jlSp have a larger than zero maximum. This 
would imply that our criterion does not detect any non- 
distillable distribution, and hence it is useless. But this 
would also imply that any distribution Gabe with posi- 
tive secrecy cost (even though it may be non-distillable) 
can increase the quality of the secret bits distilled from a 
single copy of another distribution Qabe- Actually, an 
analog of the last statement is true in the quantum case 
|14l . [l5| . That is, all entangled states (of any number 
of parties) can increase the quality of the entanglement 
that can be distilled from a single copy of another state. 



VI. CONCLUSION 

In this paper, we have presented the first criterion 
which certifies that a given distribution Gabe has no 
distillable key. In fact, this method consists on show- 



ing that Gabe does not improve the key content of any 
other distribution (i.e., it does not bring the maximally 
extractable secret bit fraction above 1/2). 

It is an open question whether all correlations with 
positive secrecy content can increase the secrecy of other 
correlations. This very interesting feature of secret cor- 
relations would invalidate the criterion presented here. 

Finally, and perhaps most interestingly: does our tech- 
nique have a quantum analogue, which could be used to 
prove the existence of entangled quantum states that do 
not contain secret key? This would present a comple- 
ment to the work by Horodecki et al. [lO|, who show the 
existence of bound entangled states that do nevertheless 
contain secret key: perhaps there exists completely bound 
entanglement which neither contains distillable key nor 
enhances key content of other states. 
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